stdout support for file backend via logger

builtin/audit/file/backend.go

@@ -5,6 +5,7 @@ import (
 	"os"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"sync"
 
 	"github.com/hashicorp/vault/audit"
@@ -28,6 +29,11 @@ func Factory(conf *audit.BackendConfig) (audit.Backend, error) {
 		}
 	}
 
+	// normalize path if configured for stdout
+	if strings.ToLower(path) == "stdout" {
+		path = "stdout"
+	}
+
 	format, ok := conf.Config["format"]
 	if !ok {
 		format = "json"
@@ -92,11 +98,16 @@ func Factory(conf *audit.BackendConfig) (audit.Backend, error) {
 		}
 	}
 
-	// Ensure that the file can be successfully opened for writing;
-	// otherwise it will be too late to catch later without problems
-	// (ref: https://github.com/hashicorp/vault/issues/550)
-	if err := b.open(); err != nil {
-		return nil, fmt.Errorf("sanity check failed; unable to open %s for writing: %v", path, err)
+	switch path {
+	case "stdout":
+		// no need to test opening file if outputting to stdout
+	default:
+		// Ensure that the file can be successfully opened for writing;
+		// otherwise it will be too late to catch later without problems
+		// (ref: https://github.com/hashicorp/vault/issues/550)
+		if err := b.open(); err != nil {
+			return nil, fmt.Errorf("sanity check failed; unable to open %s for writing: %v", path, err)
+		}
 	}
 
 	return b, nil
@@ -155,6 +166,10 @@ func (b *Backend) LogRequest(auth *logical.Auth, req *logical.Request, outerErr
 	b.fileLock.Lock()
 	defer b.fileLock.Unlock()
 
+	if b.path == "stdout" {
+		return b.formatter.FormatRequest(os.Stdout, b.formatConfig, auth, req, outerErr)
+	}
+
 	if err := b.open(); err != nil {
 		return err
 	}
@@ -183,6 +198,10 @@ func (b *Backend) LogResponse(
 	b.fileLock.Lock()
 	defer b.fileLock.Unlock()
 
+	if b.path == "stdout" {
+		return b.formatter.FormatResponse(os.Stdout, b.formatConfig, auth, req, resp, err)
+	}
+
 	if err := b.open(); err != nil {
 		return err
 	}
@@ -232,6 +251,10 @@ func (b *Backend) open() error {
 }
 
 func (b *Backend) Reload() error {
+	if b.path == "stdout" {
+		return nil
+	}
+
 	b.fileLock.Lock()
 	defer b.fileLock.Unlock()
 

website/source/docs/audit/file.html.md

@@ -56,7 +56,7 @@ Following are the configuration options available for the backend.
         <span class="param">file_path</span>
         <span class="param-flags">required</span>
             The path to where the audit log will be written. If this
-            path exists, the audit backend will append to it.
+            path exists, the audit backend will append to it. Specify `"stdout"` to write audit log to **stdout**.
       </li>
       <li>
         <span class="param">log_raw</span>